PHILADELPHIA GAS WORKS REQUEST FOR PROPOSALS FOR INFORMATION SECURITY ASSESSMENT AND TESTING SERVICES. Dated: November 20, 2015

Transcription

1 PHILADELPHIA GAS WORKS REQUEST FOR PROPOSALS FOR INFORMATION SECURITY ASSESSMENT AND TESTING SERVICES Dated: November 20, 2015 RFP NO.: 30198

2 Table of Contents 1 THE SOLICITATION NOTICE TO PROPOSERS SCHEDULE OF EVENTS PROPOSAL REQUIREMENTS PROJECT DEFINITION AND REQUIREMENTS OVERVIEW SERVICES TO BE PROVIDED TERM PROPOSAL PRICING/PAYMENT PERSONNEL MINIMUM REQUIREMENTS LICENSING INFORMATION/PRODUCT CONFIDENTIALITY MINORITY PARTICIPATION INSURANCE INDEMNIFICATION CERTIFICATE OF NON-INDEBTEDNESS NON-DISCRIMINATION MACBRIDE PRINCIPLES GOVERNING LAWS CERTAIN REQUIRED DISCLOSURES INSTRUCTIONS TO PROPOSERS PROPOSAL PREPARATION REQUIREMENTS DURATION OF PROPOSAL PROPOSER S RESPONSIBILITY PROPOSER INFORMATION PROPOSER QUALIFICATIONS STATEMENT BUSINESS EXPERIENCE FINANCIAL INFORMATION GENERAL LITIGATION DISCLOSURE BUSINESS ORGANIZATION STATEMENT WARRANTIES BY PROPOSER PROPOSAL EVALUATION, NEGOTIATION AND CONTRACT AWARD DISQUALIFICATION OF PROPOSERS QUALIFICATION OF PROPOSERS GENERAL RESERVATION OF RIGHTS AWARD Page 2 of 41

3 ATTACHMENT A. PROPOSER QUESTIONNAIRE...33 ATTACHMENT D. REQUIRED DISCLOSURE...38 ATTACHMENT I. DEMOGRAPHIC SURVEY...40 Page 3 of 41

4 1 The Solicitation Notice to Proposers Notice is hereby given that Philadelphia Gas Works ( PGW ) will receive sealed proposals on or before December 31, 2015, 2:30 p.m. Eastern Time, at the PGW Supply Chain Department, 800 W. Montgomery Avenue, Philadelphia, Pennsylvania 19122, for vulnerability assessment and penetration testing services. This document outlines PGW s objectives, describes the general characteristics of the services to be provided, and (without being exhaustive) outlines the principal obligations of PGW and the selected Proposer. Questions concerning this Request for Proposals shall be directed in writing towards Annie Wu, PGW Supply Chain Department, fax: , Annie.Wu@pgworks.com (with a copy to procurement@pgworks.com), or PGW Supply Chain Department, 800 W. Montgomery Avenue, Philadelphia, Pennsylvania Proposers may not contact other PGW personnel regarding this RFP. 1.1 Schedule of Events The projected schedule of events for this Request for Proposals is as follows: Issue Date of the RFP... November 20, 2015 Questions and requests for clarification or information must be received, in writing, at the office of the person listed above by 5 p.m. (EST)... December 4, 2015 Mandatory Telephone Conference, 10:00 a.m...december 11, 2015 Proposal Submission Due Date Must be received, in writing, at the office of the person listed above by 2:30 p.m. (EST)... December 31, 2015 Finalist Presentation(s)... TBD Notification Date... January 29, 2016 Contract Start Date... As soon as possible following contract negotiation and execution The Mandatory Telephone Conference is scheduled for 10:00 a.m. on December 11, 2015 to answer questions and requests for clarification. Proposers who choose to participate via conference call should dial as follows: ; Access Code: Once the Page 4 of 41

5 submitted proposals have been reviewed, PGW may select finalist(s) for this RFP. The finalist(s) will then be required to present their proposals at PGW. These dates are estimates only and PGW reserves the right to alter this schedule as it deems necessary or appropriate. 1.2 Proposal Requirements Proposals shall be accepted only from respondents ( Proposers ) who have: Obtained from PGW a complete set of Proposal Documents and any addenda thereto issued by PGW (sometimes referred to as the RFP ), consisting of the following five (5) sections and three (3) attachments: Sections: 1 The Solicitation Notice to Proposers 2 Project Definition and Requirements 3 Instructions to Proposers 4 Proposer Information 5 Proposal Evaluation, Negotiation and Contract Award Attachments: A Proposer Questionnaire D Disclosure Form I Demographic Survey Took part in the Mandatory Telephone Conference; and Submitted a proposal pursuant to the instructions in this RFP as set forth in Section 3. In evaluating the proposals, PGW will consider the demonstrated experience and ability of the Proposer to deliver the proposed services, the scope and value of the proposed services, and the financial proposal of each Proposer as described in this RFP. PGW hereby solicits proposals in accordance with these Proposal Documents. Page 5 of 41

6 2 Project Definition and Requirements 2.1 Overview Overview of PGW; PGW is a municipally-owned utility operated by the Philadelphia Facilities Management Corporation (hereafter referred to as PFMC ). The successful Proposer will enter into a negotiated contract with PGW by PFMC. PGW provides natural gas service to approximately 515,000 active accounts within the city of Philadelphia, using 6,000 miles of gas mains and services. PGW is the only utility currently distributing natural gas within the city of Philadelphia, and its mission is to provide safe, reliable natural gas service to the citizens of Philadelphia at a reasonable cost. 2.2 Services to be provided PGW is seeking proposals for vulnerability assessment and penetration testing services for PGW s external gateway, internal network systems, mobile wireless access controls and VoIP system. It is of the utmost importance that all testing be non-destructive while leaving no doubt of the Proposer s ability to compromise PGW s data processing facilities during the testing. The Proposer s goals in conducting this testing and assessment will be to: 1. Identify security vulnerabilities in servers, databases, desktops and network devices utilized by PGW s corporate networks, which includes a VoIP system. 2. Exploit these vulnerabilities to gain access to PGW s computing environment and get as far as possible toward attaining Root or Domain Administrator access privileges. 3. Demonstrate the attainment of elevated privileges and ability to export potentially sensitive data. 4. Identify security vulnerabilities in PGW s web applications. 5. Identify physical security vulnerabilities by attempting access to computing hardware and sensitive information using social engineering techniques. 6. Provide a written report showing the findings of the testing and assessment, including a detailed description of the tools and processes used for identification and exploitation of vulnerabilities. 7. Provide prioritized recommendations to remediate the vulnerabilities found. 8. Assist in the development of a remediation action plan based upon findings and recommendations. 9. (Optional)Return to PGW after an appropriate and mutually agreed time interval to validate the completeness of the remediation activities of the PGW staff. This will entail revisiting Steps 1 through 8 above. Page 6 of 41

7 This document outlines PGW s objectives, describes the general characteristics of the vulnerability assessment and penetration testing required to support compliance with PGW s Corporate, Regulatory and Homeland Security strategy and (without being exhaustive) outlines the principal obligations of PGW and the selected proposer. Proposer should assume: Proposer will assume the roles of an external attacker and a malicious insider while performing the services described in this RFP. As an external attacker, Proposer would be expected to test the security of PGW s external gateway, remote access capabilities, wireless access controls and VoIP system. As a malicious insider, in addition to discovering vulnerabilities and penetrating the PGW network, Proposer would be expected to test physical security controls at PGW s main campus, gas plants, outlying stations and District Offices. Proposer must not disrupt PGW operations while performing services during this engagement. Proposer will maintain strict confidentiality during this engagement and will destroy all information, reports, documentation and related data at the conclusion of the engagement. Proposer must notify PGW on a daily basis when testing is initiated and completed. The information supplied should include the source IP addresses and a description of testing method utilized. Part of testing may be scheduled for a non-primetime period to prevent disruption to PGW s business. More details about Scope of Services can be found in Attachment A Proposer Questionnaire. The Proposer must address all questions in attachment A in the proposal. 2.3 Term The contract term shall be for one (1) year. Page 7 of 41

8 2.4 Proposal Pricing/Payment Each proposal should include the fixed price to provide the services required by Section 2.2. Payment shall be by invoice issued as follows: (i) 80% following completion of services 1-6 in Section 2.2 and (ii) 20% following completion of service 7 in Section Personnel Minimum Requirements All personnel providing services hereunder shall be the subject of appropriate screening (i.e., employment verification, drug testing, criminal background, reference checks) by the Proposer. PGW reserves the right to reject any personnel based on the findings of the background investigation. 2.6 Licensing The Proposer will be authorized to do business in the Commonwealth of Pennsylvania and comply with all pertinent state and federal requirements, codes and regulations. If Proposer is a business as defined in The Philadelphia Code, Section , Proposer must have a valid commercial activities license, issued by the City of Philadelphia s Department of Licenses and Inspections, to do business in the City of Philadelphia, prior to entering into any contract with PGW. 2.7 Information/Product All reports, surveys, tables, charts, diagrams, design work, product recordings and other data (including electronic, audio and video) or documentation prepared or compiled by Proposer in connection with the performance of its obligations under the contract, shall be the sole and exclusive property of PGW. Proposer shall retain in its files, sufficiently detailed working papers relevant to its engagement with PGW. Proposer further agrees that its working papers will be held in the strictest confidence and will not be disclosed or otherwise made available to outside sources, except as required by law, without the written consent of PGW. 2.8 Confidentiality Proposer must agree to keep confidential any and all information concerning the plans, operations or activities of PGW which may be divulged by PGW or ascertained by Proposer in the course of performing services under any contract with PGW. In the event Proposer is required to disclose confidential information pursuant to a subpoena, order of a court, or other legal process, Proposer shall, upon notice of such required disclosure and prior to disclosure, immediately notify PGW and allow PGW the opportunity to inspect the information subject to disclosure, and in the event such disclosure is objectionable under Page 8 of 41

9 any standard or rule of the court, Proposer shall exhaust all legal means to prevent disclosure. 2.9 Minority Participation PGW has established an anti-discrimination policy relating to the participation of Minority, Women, and Disabled businesses and persons (collectively, DBEs ) in contracts. The purpose of PGW s DBE policy is to provide equal opportunity for all businesses and persons and to assure that PGW funds are not used, directly or indirectly, to promote, reinforce or perpetuate discriminatory practices. Proposers must complete Attachment I (Demographic Survey), attached hereto and submit same with their proposals Insurance Proposer shall procure and maintain, at its own cost and expense, insurance with companies that have an A. M. Best's Rating of not less than A- and acceptable to Philadelphia Gas Works, the following coverage with limits not less than stipulated below. Philadelphia Gas Works, Philadelphia Facilities Management Corporation and the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents, shall be included as Additional Insureds on the General Liability, Automobile Liability and Excess/Umbrella Insurance policies. An endorsement is required stating that Proposer s policies affording Additional Insured status will be primary to any other coverage available to PGW, PFMC and the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents, and any insurance maintained by PGW will be excess and non-contributory. No act or omission of PGW, PFMC, and/or the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents shall invalidate the coverage. Waiver of Subrogation shall be included on Workers Compensation, Automobile, General Liability and Excess Umbrella Liability policies. WORKERS COMPENSATION AND EMPLOYERS LIABILITY. Workers Compensation Insurance as required by statute. Employers Liability coverage to be carried with limits of not less than $1,000,000/per accident, $1,000,000/disease (policy limit), $1,000,000/disease (each employee). COMMERCIAL GENERAL LIABILITY. Commercial General Liability is required with limits of not less than $1,000,000 Each Occurrence for Bodily Injury and Property Damage; $2,000,000 General Aggregate; $1,000,000 Products/Completed Operations Aggregate and $1,000,000 Personal/Advertising Injury. This policy shall also cover liability arising from liability assumed under an insured contract (including the tort liability of another assumed in a business contract) and Personal Injury (including, but not limited to, coverage for defamation, malicious prosecution and slander). Products/Completed Operations must be included. Such policy must contain a "Severability of Interests" clause. ISO endorsement CG Page 9 of 41

10 (Contractual Liability Limitation) shall not apply to this contract. This insurance shall be excess over any other insurance, whether primary, excess, contingent or on any other basis, that is available to the contractor or its subcontractor covering liability for damages because of Bodily Injury or Property Damage for which the contractor has been included as an Additional Insured. Philadelphia Gas Works, Philadelphia Facilities Management Corporation and the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents shall be included as Additional Insureds. A copy of the actual Additional Insured Endorsement or policy wording is required. AUTOMOBILE LIABILITY. Business Automobile Liability covering all owned, nonowned and hired autos is required with limits of not less than $1,000,000 Combined Single Limit for Bodily Injury and Property Damage. Such policy must contain a "Severability of Interests" clause. Philadelphia Gas Works, Philadelphia Facilities Management Corporation and the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents shall be included as Additional Insureds. A copy of the actual Additional Insured Endorsement or policy wording is required. EXCESS/UMBRELLA LIABILITY. Proposer shall provide evidence of Excess/Umbrella Liability Insurance with limits of not less than $2,000,000 in any one claim or occurrence. The Excess/Umbrella policy shall follow form and be excess of all underlying insurance required by this contract except Professional Liability/Errors & Omissions coverage as outlined below. Philadelphia Gas Works, Philadelphia Facilities Management Corporation and the City of Philadelphia and their respective officers, employees, directors, boards, commissions and agents shall be included as Additional Insureds. A copy of the actual Additional Insured Endorsement or policy wording is required. PROFESSIONAL LIABILITY/ERRORS & OMISSIONS COVERAGE. Evidence of Professional Liability/Errors & Omissions including Cyber (Privacy) Liability coverage must be provided, with limits of not less than $5,000,000 Per Occurrence/Aggregate or Per Claim or Loss/Aggregate, with a deductible not to exceed $100,000. Errors & Omissions coverage shall be applicable to any occurrence arising out of the performance of services pursuant to any statement of work between the parties and shall cover liability arising from information technology services, including but not limited to, intellectual property infringement, privacy infringement and, if applicable, software development services and computer or electronic information technology services. Under an occurrence form, coverage required shall be maintained in full force and effect under the policy during the contract period. Under a claims made form, continuous coverage is required. Should an Extended Discovery Period or tail coverage be required in the event coverage is terminated, such coverage must be maintained for a period of not less than three (3) years. This insurance shall be primary with respect to any other insurance or self-insurance programs afforded the Proposer. Page 10 of 41

11 FIDELITY/BLANKET CRIME INSURANCE. Evidence of Fidelity/Blanket Crime Insurance with an Employee Dishonesty limit of not less than $2,000,000 shall be submitted to PGW prior to the commencement of services. Proposer must maintain third party (includes money, securities and other properties) coverage under the Crime policy. Additional Provisions A certificate of insurance evidencing all above coverage shall be filed with Philadelphia Gas Works prior to the commencement of work. Renewal certificates and policies, as required, shall be forwarded to Philadelphia Gas Works for as long as contractor performs the work as specified in this contract. All certificates and policies shall contain a provision that coverage afforded will not be cancelled or materially altered until at least thirty (30) days prior written notice has been given to Philadelphia Gas Works. It shall be the responsibility of the Proposer to ensure that all subcontractors carry insurance of not less than coverage and limits specified herein. Subcontractor must forward proper evidence of this compliance to Philadelphia Gas Works prior to the inception of any work Indemnification The Proposer will be required in the contract to indemnify, defend and hold harmless PGW, PFMC, the City of Philadelphia, and each of their respective officers, employees, directors, boards, commissions, and agents, from and against any and all losses, costs (including, but not limited to, litigation and settlement costs and counsel fees), claims, suits, actions, damages, liability and expenses, occasioned wholly or in part by Proposer s act or omission or negligence or fault or the act or omission or negligence or fault of Proposer s agents, subcontractors, suppliers, employees or servants in connection with this Agreement, including, but not limited to, those in connection with loss of life, bodily injury, personal injury, damage to property, contamination or adverse effects on the environment, intentional acts, failure to pay such subcontractors and suppliers, any breach of this Agreement, and any infringement or violation of any proprietary right (including, but not limited to, patent, copyright, trademark, service mark and trade secret), regardless of the negligence of PGW, PFMC, and/or the City of Philadelphia. In any and all claims, suits and actions against PGW, PFMC and the City of Philadelphia, and their respective officers, employees, directors, boards, commissions and agents, by any employee of Proposer, any subcontractor, or anyone for whose acts Proposer and its subcontractor is liable, the indemnification obligation set forth in this section shall not be limited in any way by any limitation on the amount or type of third party damages, compensation or benefits payable by or for Proposer or any subcontractor under workers compensation acts, disability acts, or other employees benefit acts. PGW does not indemnify. Page 11 of 41

12 2.12 Certificate of Non-Indebtedness The Proposer will be required to certify and represent that Proposer and Proposer s parent company(ies) and subsidiary(ies) are not indebted (at the time of signing of the contract) to the City of Philadelphia, PGW or PFMC (collectively the City ), and will not at any time during the term of the contract (including any extensions or renewals thereof) be indebted to the City, for or on account of any delinquent taxes (including, but not limited to, taxes collected by the City on behalf of the School District of Philadelphia), liens, judgments, fees or other debts for which no written agreement or payment plan satisfactory to the City has been established. In addition to any other rights or remedies available to PGW at law or in equity, Proposer acknowledges that upon any breach or failure to conform to such certification PGW shall have the right to, and may, at the option of PGW, withhold payments otherwise due to Proposer, and, if such breach or failure is not resolved to PGW s satisfaction within a reasonable time frame as specified by PGW in writing, this will offset any such indebtedness against said payments and/or terminate this Agreement for default (in which case Proposer shall be liable for all excess costs and other damages including reasonable attorney s fees resulting from the termination) Non-Discrimination Proposer shall not discriminate or permit discrimination against any person because of race, color, religion, national origin, sex or sexual orientation. In the event of such discrimination, PGW may, in addition to any other rights or remedies available under the contract, at law or in equity, terminate any contract with Proposer forthwith. Proposer shall comply with the provisions of Title VII of the Civil Rights Act of 1964 (42 U.S.C. 200d et seq.), 504 of the Federal Rehabilitation Act of 1973 (29 U.S.C. 794), The Age Discrimination Act of 1975, (42 U.S.C et seq.), Title IX of the Education Amendments of 1972, (20 U.S.C. 1681), and 45 C.F.R. Part 92, as they may be amended from time to time, which together prohibit discrimination on the basis of race, color, national origin, sex, handicap, age and religion. Proposer understands and agrees that no individual with a disability shall, on the basis of the disability, be excluded from participation in any contract of Proposer with PGW or from activities or services provided under such contract. As a condition of accepting and executing such contract, Proposer shall comply with all provisions of the Americans with Disabilities Act, 42 U.S.C et seq., and all regulations promulgated thereunder, as the Act and regulations may be amended from time to time, which are applicable (a) to Proposer, (b) to the benefits, services, activities, facilities and programs provided in connection with this Agreement, (c) to PGW, or the Commonwealth of Pennsylvania, and (d) to the benefits, services, activities, facilities and programs of PGW or of the Commonwealth. Without limiting the generality of the preceding sentence, Proposer shall comply with the General Prohibitions Against Discrimination, 28 C.F.R , and all other regulations promulgated under Title II of The Americans with Disabilities Act, as they may be Page 12 of 41

13 amended from time to time, which are applicable to the benefits, services, programs and activities provided by PGW through contracts with outsider contractors MacBride Principles Proposer certifies and represents that, to the best of its knowledge, (i) Proposer (including any affiliates under its direct control) does not have, and will not have at anytime during the term of any contract with PGW (including any extension or renewal thereof), any investments, licenses, franchises, management agreements or operations in Northern Ireland and (ii) no product to be provided under any contract with PGW will originate in Northern Ireland, unless Proposer has implemented the fair employment principles embodied in the MacBride Principles. In the performance of any contract with PGW, Proposer covenants that it will not utilize any suppliers, subcontractors at any tier (i) who have (or whose parent, subsidiary, exclusive distributor or affiliates have) any investments, licenses, franchises, management agreements or operations in Northern Ireland or (ii) who will provide products originating in Northern Ireland unless said supplier or subcontractor has implemented the fair employment principles embodied in the MacBride Principles. Proposer further covenants to include the provisions of this paragraph, with appropriate adjustments for the identity of the parties, in all subcontracts and supply agreements which are entered into in connection with the performance of any contract with PGW. Proposer covenants that it will cooperate with PGW and City s Director of Finance in any manner which PGW and the said Director deem reasonable and necessary to carry out PGW s and the Director s responsibilities under Section of the Philadelphia Code which embodies the requirements set forth in this section. Proposer understands and agrees that any false certification or representation in connection with this section and any failure to comply with the provisions of this section shall constitute a material breach of any contract with PGW entitling PGW to all rights and remedies provided therein or otherwise available in law (including, but not limited to, Section of the Philadelphia Code) or equity. In addition, Proposer understands that false certification or representation in connection with this section is subject to prosecution under Title 18 Pa.C.S.A. Section Governing Laws Any contract entered into by PGW will be executed in and shall be governed by the laws of the Commonwealth of Pennsylvania Certain Required Disclosures In accordance with The Philadelphia Code Title 17 Chapter , persons and entities who wish to provide goods and services to PGW must provide certain information about contributions they have made to elected City officials or candidates for City offices. All Proposers must therefore complete Attachment D and include such completed Attachment Page 13 of 41

14 with their proposal. Please note that the selected Proposer will be required to update such disclosure during the term of its agreement with PGW and for one year thereafter. Page 14 of 41

15 3 Instructions to Proposers 3.1 Proposal Preparation Requirements Proposals must be prepared in English on 8 ½ x 11 inch paper with tabbed indexes separating the following six (6) completed sections in the following order: Tab 1: Transmittal letter Tab 2: Completed Attachment A Tab 3: Proposal Pricing Tab 4: Completed Section 4 (Proposer Information) of this RFP. All Proposals must include the following information and be signed (at the end of Section 4) as follows: If the Proposal is made by an individual, the Proposal must be signed by the individual, the individual s full name must be typed or printed under the signature line and the Proposal must include the individual s mailing address If the Proposal is made by a partnership, the Proposal must: a) be signed by at least one of the general partners with authority to bind the partnership and the name of the general partner must be typed or printed under the signature line; b) include the name and mailing address of the partnership; and c) attach a copy of the partnership agreement, or other document authorizing the general partner to sign the Proposal to bind the partnership; If a corporation makes the Proposal, the Proposal must: a) be signed by the president or vice president of the corporation, and the secretary or treasurer must attest the signature and the names of the corporate officers must be typed or printed under the signature lines; b) include the name and mailing address of the corporation; and Page 15 of 41

16 c) attach a copy of the corporation s by-laws or a corporate resolution authorizing the corporate officer signing the Proposal to bind the corporation If the Proposal is made by a joint venture, the Proposal must: a) be signed by all joint venture partners and the names of the joint venture partners must be typed or printed under the signature lines; b) include the name and mailing address of the joint venture; and c) attach a copy of the joint venture agreement or other documentation signed by each member of the Joint Venture and, if applicable, any documentation necessary to show that the individuals signing on behalf of each joint venture partner are authorized to bind the joint venture Tab 5: Qualification and Experience of Proposer. Proposers are strongly encouraged to list experience providing similar services Provide the names and resumes of each person who would be participating in this project; Indicate whether the individual is a full time employee of Proposer s organization (and if so for how long) or a subcontractor. If the individual is a subcontractor, list the engagements (and the particular responsibilities on each engagements) that the subcontractor has previously worked for Proposer; Indicate the areas of the project that each individual will be involved with or have responsibility for; For each such individual, provide a reference list with phone numbers Tab 6: Completed Attachments D and I, and any other attachments (other than Attachment A) required to be completed under the RFP One (1) original Proposal, one (1) copy and one (1) CD containing a searchable PDF readable by Adobe Reader 7.0 or higher of the proposal, must be submitted in a sealed envelope or envelopes addressed to PGW Supply Chain Department, Philadelphia Gas Works, 800 W. Montgomery Avenue, Philadelphia, Pennsylvania The name and address of the Proposer must also appear on the face of the envelope. The PDF file name should be as follows: PROPOSER_RFP_######.PDF where Proposer is your company name and ###### is the PGW RFP number. Page 16 of 41

17 3.1.3 Failure to answer all questions completely and furnish all information required in these Proposal Documents may result in disqualification of the Proposer. PGW reserves the right to thoroughly investigate the financial status and experience of the Proposer It shall be the responsibility of the Proposer to deliver the Proposal and all other required items to the location specified in Section 1 of these Proposal Documents on or before the due date and time set forth in Section Oral communications from PGW personnel or other persons shall not be binding on PGW and shall in no way modify the provisions of the Proposal Documents. Official responses of PGW to inquiries regarding these Proposal Documents shall be issued by PGW in writing as addenda, and only such written responses shall be binding on PGW as modifications to these Proposal Documents. 3.2 Duration of Proposal In consideration of PGW s evaluation of the submitted Proposals, each Proposer agrees that its Proposal shall be a firm offer to PGW, and shall remain open for acceptance by PGW for a period of at least one hundred and fifty (150) days beginning with the submission due date set forth in Section 1 of these Proposal Documents, as may be revised by addenda. 3.3 Proposer s Responsibility The Proposer shall carefully examine the terms of the Proposal Documents and shall judge for itself all of the circumstances and conditions affecting its Proposal. PGW will endeavor to present accurate information, but Proposers are advised to independently verify the accuracy of any information received. Page 17 of 41

18 4 Proposer Information 4.1 Proposer Submitted by: [Please type or print] Name: Address: Telephone: Facsimile: The undersigned Proposer hereby submits to PGW this Proposal as described herein and in the attached documents. 4.2 Qualifications Statement The Proposer represents and covenants that the Proposer is fully qualified to provide the requested services to PGW. The undersigned further swears and affirms that the information contained in this response is true, accurate and complete. 4.3 Business Experience The following describes other points of service by Proposer and the companies for whom the services were provided. Proposer should include a reference contact at the described companies, and this contact should have direct, specific responsibility Page 18 of 41

19 for the oversight of the program. In particular, the Proposer should describe all experience with projects similar to this project The Proposer has operated under its current name since, a period of years, and the Proposer (if such be the case) formerly operated under the following name:. Page 19 of 41

20 4.3.3 Proposer must attach the resume of the manager which it anticipates will be the contact for the services required by this RFP The Proposer submits herewith the following list of three (3) persons or businesses, which have knowledge of the Proposer s ability to successfully perform the services for which this Proposal is submitted. REFERENCE NO. 1 Name: Firm: Title: Address: Telephone: Facsimile: Nature of Association: REFERENCE NO. 2 Name: Firm: Title: Address: Telephone: Facsimile: Nature of Association: Page 20 of 41

21 REFERENCE NO. 3 Name: Firm: Title: Address: Telephone: Facsimile: Nature of Association: The Proposer has not had an agreement canceled or terminated due, in whole or in part, to the fault of Proposer, or a default or breach of contract on the part of the Proposer. (If a contract or agreement has been canceled, please explain.) 4.4 Financial Information The Proposer acknowledges and agrees that any financial information disclosed to PGW will be subject to disclosure under the Philadelphia Home Rule Charter and/or the Commonwealth Right to Know Act. The Proposer expressly waives any right to claim that any financial information provided is exempt from disclosure. The Proposer agrees that PGW may make such disclosure or reproduce such financial information as is deemed necessary or convenient by PGW, its officers, agents, or employees, for PGW s use in Proposal evaluation and comparison; provided, however, that if any person makes a request as contemplated by the Philadelphia Home Rule Charter and/or Commonwealth Right to Know Act to review or be provided with copies of such financial information or any part thereof, and PGW denies such requests, immediately upon notification thereof, the Proposer shall, at its sole cost and expense, defend PGW and its officers, agents, and employees against any action resulting from denial of such request. If the Proposer fails to promptly provide such defense, PGW, its officers, agents, and employees shall be free to grant such requests, and the Proposer shall be deemed to have waived any cause of action, whether in law or in equity, that it may have against PGW respecting such disclosure. The Proposer agrees to indemnify and hold harmless PGW, its officers, agents, and employees from any and all claims, costs, liabilities or damages, including attorney s fees and court costs resulting from PGW s or Proposer s acts or omissions pursuant to this Paragraph. Page 21 of 41

22 4.4.2 The Proposer has ( ) has never ( ) [check one] had a bond or surety canceled or forfeited. (If the Proposer has had a bond or surety canceled, state the name of the bonding company, date, amount of bond and reason for such cancellation or forfeiture.) The Proposer has ( ) has never ( ) [check one] been adjudged bankrupt (Chapter 7), or petitioned the court for relief under the Bankruptcy Code or Act for either business reorganization (Chapter 11) or the Wage Earner s Plan (Chapter 13). If the response is in the affirmative, provide the following information: Date petition filed Case No. and jurisdiction Amount of liabilities and debts Date of discharge or successful completion of reorganization or wage earner s plan The Proposer s bank references are: Name Address The undersigned herewith submits a letter from (name of financial institution) indicating that the Proposer has an available working line of credit of no less than Dollars ($ ), or other evidence of Proposer s capital sufficient to permit it to meet the obligations contemplated by its Proposal The undersigned hereby affirms that the Proposer is authorized to conduct business in the Commonwealth of Pennsylvania, and City of Philadelphia, or will obtain proper authorization to do so before executing an agreement and furnishing the required bond or letter of credit, if any. Page 22 of 41

23 4.5 General Litigation Disclosure Proposer must describe any pending, contemplated or ongoing administrative or judicial proceedings material to Proposer s business, finances or products including, but not limited to, any litigation, consent orders, debarment or contracts with any local, state or federal regulatory agency issued to Proposer or to any parent or subsidiary of Proposer:. 4.6 Business Organization Statement General Information Name of Firm [Exactly as it would appear on an agreement; if operating under a fictitious name, so indicate.] Principal Office Address: Telephone Number: Form of Business Entity [check one] ( ) Corporation ( ) Partnership ( ) Individual ( ) Joint Venture Page 23 of 41

24 4.6.2 Corporation Statement If a corporation, answer the following: Date of incorporation: Location of incorporation: Is the corporation authorized to do business in Pennsylvania? Yes ( ) No ( ) If so, as of what date? The corporation is held: Publicly ( ) Privately ( ) Furnish the name, title, and address of each director and officer of the corporation. DIRECTORS Name Address Principal Business Affiliation Other than Proposer s Directorship Page 24 of 41

25 SHAREHOLDERS Name Address Number of Shares Owned OFFICERS Name Position Page 25 of 41

26 4.6.3 Partnership Statement If a partnership, answer the following: Date of organization: General Partnership ( ) Limited Partnership ( ) Partnership Agreement recorded? Yes ( ) No ( ) Date Book Page County State Has the partnership done business in Pennsylvania? Yes ( ) No ( ) When? Name, address, and ownership share of each general partner owning more than five percent (5%) of the partnership: Name Address % of Ownership 1. % 2. % 3. % 4. % 5. % 6. % Page 26 of 41

27 4.6.4 Joint Venture Statement If a Joint Venture, answer the following: Date of organization: Joint Venture Agreement recorded? Yes ( ) No ( ) Date Book Page County State Has the Joint Venture done business in Pennsylvania? Yes ( ) No ( ) When? Name, address of each Joint Venturer and percent of ownership of each: Name Address % of Ownership 1. % 2. % 3. % 4. % 5. % 4.7 Warranties by Proposer The Proposer s Proposal has been completed to the best of the Proposer s ability, and the Proposer swears that all information contained herein is true, correct and complete to the best of the Proposer s knowledge, information and belief. Page 27 of 41

28 4.7.2 By submission of this Proposal, the Proposer acknowledges that PGW has the right to make any inquiry or investigation it deems appropriate to substantiate or supplement information contained in the Proposal, and Proposer authorizes the release to PGW of any and all information sought in such inquiry or investigation The Proposer declares by the submission of this Proposal that the Proposal is not made in the interest of, or on behalf of, any undisclosed person, partnership, company, association, organization, or corporation; that the Proposal is genuine and not collusive or sham; that the Proposer has not directly or indirectly induced or solicited any other Proposer to put in a false or sham Proposal, and has not directly or indirectly colluded or agreed with any Proposer or anyone else to put in a sham Proposal or to refrain from proposing; that the Proposer has not directly or indirectly sought by agreement or communication to secure any advantage against PGW; anyone interested in the Proposal as principal are named within the Proposal; that all statements contained in the Proposal are true; that the Proposer has not directly or indirectly divulged information or data relative to the Proposer s Proposal to any other person, partnership, corporation, or association, except to such person or persons as have a direct financial interest in the Proposer s general business. The foregoing Proposal is hereby submitted by the entity signing below in accordance with all terms and conditions as set forth in the Request for Proposals issued by PGW. PROPOSER: DATE: (Corporate Seal if Applicable) Name of Proposer By: (signature) Name: Title: Attest: (signature) Name: Title: [Add signature lines as necessary below.] Page 28 of 41

29 5 Proposal Evaluation, Negotiation and Contract Award 5.1 Disqualification of Proposers If more than one Proposal is received from any individual, firm, partnership, corporation, or association, under the same or different names, said Proposals will not be considered. Reasonable grounds for believing that any Proposer has an interest in more than one Proposal will cause the rejection of all Proposals in which such Proposer is interested. If there is reason to believe that collusion exists among Proposers, none of the participants in such collusion will be considered. Similarly, unsolicited proposals may not be considered No Proposal shall be received from, or contract awarded to, any PGW or City employee or official who may have any direct or indirect interest in such submitted Proposal or contract. 5.2 Qualification of Proposers PGW will carefully consider the Proposer s qualifications, proposed financial consideration, experience, financial responsibility proposed scope of services, and timeline in evaluating each Proposal. In PGW s evaluation, the Proposal as a whole may bear more weight than the individual parts of the Proposal Following PGW s review of the submitted proposals, PGW may select one or more Proposers with which to negotiate. PGW shall notify Proposer(s) of selection for negotiations. The date that the Proposer s receipt of the notification is confirmed by PGW, is referred to herein as the Notification Date Respondents to this RFP are subject to Philadelphia Code (Chapter ) and the Pennsylvania Ethics Act (65 P.S. Section 401 et.seq.) All respondents are required to disclose any potential conflict caused by PGW or City employees having a financial interest in the entity entering into a contract or agreement with PGW. 5.3 General Reservation of Rights This RFP and the process it describes are proprietary to PGW and are for the sole and exclusive benefit of PGW. No other party, including any respondent to this RFP or future Proposer to any RFP which may be issued by PGW, is intended to be granted any rights hereunder. The Proposer acknowledges and agrees that any materials submitted in response to this RFP will be subject to disclosure under the Philadelphia Home Rule Charter and/or the Commonwealth Right to Know Act. The Proposer expressly waives any right to claim that any materials provided are exempt from disclosure. The Proposer agrees that PGW may make such disclosure or reproduce such materials as is deemed necessary or convenient by PGW, its Page 29 of 41

30 officers, agents, or employees, for PGW s use in Proposal evaluation and comparison; provided, however, that if any person makes a request as contemplated by the Philadelphia Home Rule Charter and/or Commonwealth Right to Know Act to review or be provided with copies of such materials or any part thereof, and PGW denies such requests, immediately upon notification thereof, the Proposer shall, at its sole cost and expense, defend PGW and its officers, agents, and employees against any action resulting from denial of such request. Any materials submitted or ideas elicited in response to this RFP shall be the sole and absolute property of PGW with PGW having title thereto and unrestricted use thereof PGW reserves the right to reject as informal or non-responsive any Proposal that, in PGW s sole judgment, is incomplete, is not in conformity with applicable law, is not responsive to this RFP, or contains ambiguities or services not called for by this RFP Without limiting the generality of any other provision of this RFP, PGW reserves the right, at any time prior to execution of an agreement with the successful Proposer, to exercise all or any of the following rights and options, which rights and options PGW may exercise to the extent that PGW, in its sole discretion, deems to be in its best interests: To request additional or supplemental information (including but not limited to information inadvertently omitted by any Proposer in response to this RFP) from any or all Proposers; To accept or reject, at any time prior to its execution of an agreement, any or all Proposals or any part thereof submitted in connection with this RFP; To accept or reject any or all of the items in any Proposal and award the contract in whole or in part if it is deemed in PGW s best interest to do so; To waive any informality, defect, non-responsiveness, or derivation from this RFP that is not, in PGW s sole judgment, material to the Proposal; To negotiate unacceptable provisions incorporated within an otherwise acceptable Proposal submitted in response to this RFP; To reject without evaluation any Proposal that is incomplete, unclear, conditional, or which contains irregularities of any kind; To reject any Proposal that in the sole discretion of PGW is not in the best interest of PGW; To re-issue this RFP without change or modification; Page 30 of 41

31 To issue a subsequent RFP for this project with terms and conditions that are substantially different from the terms and conditions set forth in this RFP; To cancel this RFP with or without issuing another RFP; To supplement, amend, substitute, or otherwise modify this RFP at any time prior to execution of a final agreement with a Proposer; To reject the Proposal of a Proposer that, in PGW s sole judgment, has been delinquent or unfaithful in the performance of any contract with PGW, or is financially or technically incapable of performing the services required in this RFP, or is otherwise not a responsible Proposer; To permit or reject, at PGW s sole discretion, amendments (including information inadvertently omitted), modifications, alterations and/or corrections of Proposals by some or all of the Proposers following Proposal submission; To request that some or all of the Proposers modify Proposals or provide additional information following evaluation by PGW; To conduct such investigations as PGW considers appropriate with respect to the qualifications of any Proposer and/or any information contained in any Proposal; To request clarifications of any unclear Proposal; To negotiate simultaneously, or otherwise, with one or more Proposers; To discontinue and resume negotiations with one or more Proposers; To rescind its rejection of any Proposal(s) and negotiate (or resume negotiations) with a previously rejected Proposer; To not proceed with the process described in this RFP, or to change any time schedules set forth herein; To not enter into an agreement pursuant to this RFP PGW intends to enter into contract negotiations with the selected Proposer. However, PGW reserves the right to terminate any negotiations at any time or conduct simultaneous, competitive negotiations with multiple Proposers. PGW reserves the right to negotiate acceptable terms in an otherwise unacceptable Proposal. Such negotiations may result in changes to material terms of this RFP; in Page 31 of 41

32 such event, PGW shall not be obligated to inform other Proposers of the changes, or permit them to revise their Proposals accordingly, unless PGW, in its sole discretion, determines that doing so and permitting such is in PGW s best interest. Should negotiations not prove satisfactory with the recommended Proposer(s), PGW reserves the right to discontinue negotiations with the recommended Proposer(s) and additional firms may be asked to enter into negotiations or PGW may solicit new Proposals or issue a new Request for Proposals. 5.4 Award PGW intends to award the agreement to the Proposer whose Proposal best satisfies the scope of services described in Section 2 and is otherwise in the best interest of PGW. The determination of award shall be made by PGW, in its sole discretion, which decision shall be final. PGW may employ such analysis techniques and professional consultants for Proposal evaluation as it deems necessary. PGW may request submission of additional information to assist it in evaluating a Proposal, and the Proposer shall cooperate fully with such request. The contract resulting from this RFP will be awarded to the qualified Proposer whose Proposal PGW believes will be the most advantageous to PGW. PGW may condition an award on the successful Proposer s agreement to such terms and conditions as required by PGW including, but not limited to, PGW s indemnification. Page 32 of 41

33 ATTACHMENT A. PROPOSER QUESTIONNAIRE About your company Qualifications and References Please describe at least three (3) engagements for Vulnerability Assessment and Penetration Testing your company has conducted including a statement regarding the type of IT infrastructure and the results for each. Please provide resumes for staff that will be assigned to the engagement at PGW. Identify the staff member who will be acting as the project manager. Please provide information pertaining to the project manager s experience dealing with gas or other utilities and provide references. Does the assigned staff possess any government security clearances? Please describe how you stay abreast with the changing governmental regulations and industry guidelines for cyber security. Do you outsource any of your penetration or vulnerability assessment work? Does your company employ former hackers? How does your company collect exploits? How does your company train its employees? Does your company test the exploits it utilizes in a lab prior to using them in the field? Provide documentation or explanation: Dedication to Penetration Testing and Assessment 1) # of employees 2) R&D as % of revenue 3) Enterprise Market share Year to Date FY2014 revenue Number of offices Number of professional services personnel Number of R&D and support personnel User Conferences where your company participated References / Contacts minimum of 3 Client List Please describe any other pertinent information you would like us to know on a separate page. Resource Requirements Please describe in detail: The support that will be required from PGW staff by position and estimated number of hours. Any special skill sets required by the PGW staff to effectively participate in the project Access requirements to the PGW facility, including workspace and remote access (list by user name, schedule and duration of requirement) Page 33 of 41